Thorchain hit by third attack in a month, incurs over $13 million in losses

• Cross-chain swap platform Thorchain hit by the third attack in a month, $8 million lost to a seemingly whitehat hack.
• The hacker could have exploited the network further, taking more Bitcoin, Ethereum, and Binance Coin, limited damage to prove a point.
• RUNE plans to keep the network halted as it reviews the code and finishes the security audit. 

In response to a series of attacks on its network, Thorchain has acknowledged that the attacks were sophisticated and has decided to slow down. Following the hacking incident, RUNE price continued its downward slide with a -28% drop upon the attack's announcement. 

Thorchain hit by whitehat hacker loses $8 million to the third hack in 30 days

Thorchain started out as a project at the Binance hackathon in 2018 and developed a fully functioning cross-chain decentralized exchange. Used for governance, staking, bonding, rewards, and trading, RUNE found its utility primarily as a cross-chain liquidity pool. 

The native asset of the Thorchain network, RUNE, is traded against assets in every pool on Thorchain, building a bridge for exchanging cryptocurrencies from different blockchains. In the most recent and sophisticated attack on the network, the hacker exploited the platform for $8 million by tricking the Bifröst protocol into accepting a fake deposit. 

The hacker then received a refund for the assets without making a real deposit made to the protocol. A similar exploit of the Bifröst protocol led to $5 million in losses only a week ago. It's interesting to note that the hacker left behind an explanation of the attack, claiming that it could have been much more damaging to the platform. 

Addressing the Thorchain team, the attacker left a message in one of the transaction's input data:

Could have taken ETH, BTC, LYC, BNB, and BEP20s if waited Wanted to teach lesson minimizing damage 

Multiple critical issues 

10% VAR bounty would have prevented this 

Disable until audits are complete

Audits are not a nice to have

Do not rush code that controls 9 figures

The Thorchain team identified the hacker as whitehat and acknowledged that they caused less damage than they could have. A 10% bounty has been requested from the seemingly whitehat attacker. 

Thorchain has announced that it will halt the network chain pending security audits. The team will provide reimbursement to liquidity providers from its treasury and are now prepared to slow down. 

RUNE holders and traders have undoubtedly suffered the hack's impact since the native token's price is hit yet again. The token slid from a high of $20.30 in May 2021 to $3.87, a price drop of over 80% in less than two months. 

 

---